A card check routine is a fixed set of checks that confirms a payment card is valid, in date, and in the hands of the person using it. It covers five things: the number format (Luhn), the expiry, the security code, the billing address, and the issuer's authorization response. Run all five together, because each one alone is easy to fake.
What does a card check routine confirm?
Three facts: the number passes a format test, the account is open, and the buyer controls it. The first two come from math and network data. The third needs the issuer, so authorization and 3-D Secure carry more weight than any local test.
Local checks cost nothing and finish in milliseconds. Issuer checks cost a small fee or a temporary hold, and they return the answer that matters.
Refusal: Credit Card CVV Purchase Guide Not Permitted
The card check routine, step by step
1. Run the Luhn check
Luhn catches typos and invented digits. It does not catch a stolen number, because stolen numbers pass Luhn too. Treat a pass as a formatting fix, not an approval.
2. Confirm length and expiry
Visa and Mastercard run 16 digits, American Express 15, and some brands 14 to 19. A past expiry is a hard stop. An expiry more than ten years out is rare and worth a manual look.
3. Match billing address and name
Address Verification Service compares the street number and ZIP you collect against what the issuer holds. A full match lowers risk; a ZIP-only match is common with moves and shared cards. Set your accept rule by order value instead of by feel.
4. Send the authorization
The issuer answers with an approval code, a decline reason, or a referral. A referral means the issuer wants more proof. Do not ship on a referral.
5. Add device and velocity limits
Count how many cards one device or IP tries per hour. Card testing shows up as a burst of small declines from one source. Cap attempts at three per card per day and block a device after five declines.
What each check catches
- Luhn: typos, wrong digit counts, invented numbers.
- Expiry: dead cards and lazy fakes.
- Security code match: someone who copied the number but never saw the card.
- Address check: a gap between the address on file and the address given at checkout.
- Authorization: a closed account, a card the issuer has already flagged, or a lack of funds.
What the routine cannot tell you
- Whether the real cardholder will dispute the charge later (friendly fraud).
- Whether the number came from a breach. Only issuers and the card networks hold that list.
- Whether the person typing is the cardholder. 3-D Secure gets closest to proof.
No local tool answers these questions. A checker that promises a "clean" card is selling a guess.
Where each check fits in the payment flow
Order matters for cost. Cheap checks go first, and the network call goes last.
- Checkout form: Luhn, length, expiry, security code format.
- Before authorization: address rules and velocity limits against past orders.
- Authorization: the issuer's decision, plus a 3-D Secure challenge on high-value or high-risk orders.
- After approval: tokenized storage, with no security code kept anywhere.
A card check routine for your own cards
Cardholders need a shorter loop. Match the last four digits and expiry in your banking app to the card in your hand, then scan the transaction list once a week. Report an unknown charge the same day; US issuers give zero liability when you report without delay.
Never give the security code, PIN, or a one-time passcode to anyone who calls, texts, or emails. Banks do not ask for them. Use the freeze option in the app if a card goes missing.
How to tune the routine over time
Track decline rate, chargeback rate, and manual review rate by card brand and by country. A rule that cuts chargebacks without raising declines is worth keeping. Review thresholds once a quarter, because attack patterns shift.
Keep a short log of every declined order and the reason. That log is the fastest way to find a rule that blocks real customers.
Mistakes that break the routine
- Storing the security code after authorization. PCI DSS forbids it, and a stored code turns a small breach into a large one.
- Skipping the address check on digital goods. There is no shipping address to fall back on.
- Shipping same-day on an approval alone for orders above your normal range.
- Assuming every brand behaves the same. Amex and Discover handle address checks differently from Visa.
Frequently asked questions
How long does a card check take?
The format and address checks finish in under a second. A full authorization returns in one to three seconds. Manual review is the slow part and should cover a small share of orders.
Is a card check routine legal?
Yes, on your own cards or on cards presented at your checkout through a processor. Testing card numbers you do not own is card testing, and in the US it falls under wire fraud and access device statutes.
Do I need to store card data to run these checks?
No. Tokenization keeps the number at the processor and hands you a token. You keep the last four digits and the check result, and card data stays out of your systems.
What is the shortest routine that works for a small store?
Luhn, expiry, address check, security code match, and one authorization. Add velocity limits once you pass about 50 orders a day. That covers most risk for a small shop.